PhpWiki 1.5.4 - Multiple Vulnerabilities

PhpWiki 1.5.4 - Multiple Vulnerabilities Title: phpwiki 1.5.4 - Cross Site Scripting / Local File Inclusion Date: 29.08.15 Vendor: sourceforge.net/projects/phpwiki/ Affected versions: = 1.5.4 current Tested on: Apache2.2 / PHP5 / Deb32 Author: Smash Contact: smash at devilteam.pl 1/ Cross Site...

SAP NetWeaver Portal XML External Entity Vulnerability

SAP NetWeaver is a service-oriented, integrated application platform from SAP that provides a development and runtime environment for SAP applications.SAP NetWeaver Portal is a portal solution that provides single sign-on information for authentication via a Web browser. An XML external entity...

Arbitrary File Read Vulnerability in Jinhe IOAS Standard Office System for SMEs

Beijing Jinhe Network Co., Ltd. is an enterprise that provides informationization solutions and collaborative management software, and IOAS Standard Office System for Small and Medium-sized Enterprises is one of the products of Beijing Jinhe Network Co. IOAS is a product of Beijing JinHe Network...

PT-2015-6790 · Openstack · Openstack Image Service

Name of the Vulnerable Software and Affected Versions: OpenStack Image Service Glance versions 2015.1.x before 2015.1.2 kilo Description: The issue allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image when using the V2 API. Recommendations: For...

Spree Commerce 'rabl_template.rb' Arbitrary File Read Vulnerability

Spree also known as Spree Commerce is the United States Spree Commerce, Inc. based on Ruby on Rails open source e-commerce solutions. An arbitrary file read vulnerability exists in Spree Commerce. An attacker can exploit this vulnerability to read arbitrary files in the context of an application...

Symantec Endpoint Protection Manager Arbitrary File Read Vulnerability

Symantec Endpoint Protection Manager SEPM is a suite of enterprise-grade virus protection software from Symantec USA. The software protects against malicious attacks such as viruses, worms, and Trojan horses. SEPM 12.1-RU6-MP1 A security vulnerability exists in the action handler in the managemen...

Symantec Endpoint Protection Multiple Issues

SUMMARY The management console for Symantec Endpoint Protection Manager SEPM is susceptible to multiple vulnerabilities including SQL Injection, authentication bypass, possible path traversal and the potential for arbitrary file read/write. SEP clients are susceptible to a binary planting...

Wedge WedgeOS Arbitrary File Read Vulnerability

Wedge WedgeOS is a network stack implementation. An arbitrary file read vulnerability exists in Wedge WedgeOS, which allows remote attackers to read arbitrary files...

Accellion FTA 'statecode' Cookie Arbitrary File Read

This module exploits a file disclosure vulnerability in the Accellion File Transfer appliance. This vulnerability is triggered when a user-provided 'statecode' cookie parameter is appended to a file path that is processed as a HTML template. By prepending this cookie with directory traversal...

Roundcube Webmail Arbitrary File Read Vulnerability

RoundCube Webmail is a browser-based IMAP client mail client that supports address book management, message searching, spell checking and more. An arbitrary file read vulnerability exists in Roundcube Webmail. An attacker can exploit this vulnerability to read arbitrary files...

Mozilla Firefox Arbitrary Code Execution Vulnerability (CNVD-2015-04353)

Mozilla Firefox is a web browser released by Mozilla. A security vulnerability exists in Mozilla Firefox version 38.0 and Firefox ESR version 38.0, which can be exploited by remote attackers to read arbitrary files or execute arbitrary JS code via a constructed website...

Z-BLOG Blind-XXE Arbitrary File Read Vulnerability

Z-Blog is developed by RainbowSoft Studio a Blog program based on the Asp platform . Z-Blog has an arbitrary file read vulnerability. /zbsystem/xml-rpc/index.php directly call simpleloadstring parsing XML, resulting in XML entity injection, an attacker can read system files using the vulnerabilit...

WordPress Slider Revolution Plugin Directory Traversal Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on servers with PHP and MySQL.Slider Revolution revslider is one of the slideshow plugin. A directory traversal vulnerability exists in...

IBM Tivoli Storage Manager FastBack Arbitrary File Read Vulnerability (CNVD-2015-04163)

IBM Tivoli Storage Manager FastBack is a suite of software that provides continuous data protection and recovery management capabilities for Microsoft Windows and Linux servers. An arbitrary file read vulnerability in IBM Tivoli Storage Manager FastBack version 6.1 prior to 6.1.12 allows remote...

IBM Tivoli Storage Manager FastBack Arbitrary File Read Vulnerability (CNVD-2015-04164)

IBM Tivoli Storage Manager FastBack is a suite of software that provides continuous data protection and recovery management capabilities for Microsoft Windows and Linux servers. An arbitrary file read vulnerability in IBM Tivoli Storage Manager FastBack version 6.1 prior to 6.1.12 allows remote...

WedgeOS 4.0.4 Arbitrary File Read / Command Execution

, , . '.' '. ', . , '. , .', , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' =''"''=. presents.. WedgeOS Multiple Vulnerabilities Affected versions: WedgeOS = 4.0.4 PDF: http://www.security-assessment.com/files/documents/advisory/WedgeOS-Final.pdf...

[ERPSCAN-15-005] SAP Mobile Platform - XXE

ERPSCAN Research Advisory ERPSCAN-15-005 SAP Mobile Platform - XXE Application: SAP Mobile Platform 2.3 Versions Affected: SAP Mobile Platform 2.3, probably others Vendor URL: http://SAP.com Bugs: XML eXternal Entity Sent: 06.11.14 Reported: 06.11.14 Vendor response: 07.11.14 Date of Public...

SAP Mobile Platform External Entity Vulnerability

SAP Mobile Platform SMP is a mobile application development platform from SAP. The platform is used to build packaged and customized development applications for any device. An external entity vulnerability exists in SAP Mobile Platform. A remote attacker can exploit this vulnerability by sending...

CVE-2015-2860

Summary: CVE-2015-2860 is a directory traversal vulnerability in Avigilon Control Center (ACC) Server. The issue allows an unauthenticated remote attacker to read arbitrary files via a crafted /help/ URL. Affected versions are ACC Server 4 before 4.12.0.54 and 5 before 5.4.2.22. The root cause is...

Z-BLOG Blind-XXE result in arbitrary file read vulnerability warning-the black bar safety net

Download the latest version of Z-Blog: http://bbs.zblogcn.com/thread-88670-1-1.html /zbsystem/xml-rpc/index.php 6 4 1 row: $zbp-Load; AddFilterPlugin'FilterPluginZbpShowError','RespondError'; $xmlstring = filegetcontents 'php://input' ; //Logs$xmlstring; $xml = simplexmlloadstring$xmlstring; The...